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SUMMARY 

PURPOSE: (U//FOUO) To forward to the Intelligence Oversight Board (lOB) of the 
President’s Foreign Intelligence Advisory Board, via the Assistant to the Secretary of Defense 
for Intelligence Oversight (ATSD(IO)), NSA’s quarterly report on its intelligence activities. 

BACKGROUND: (U//POUO) Executive Order 12333 and Executive Order 12863 
require Intelligence Community agency heads and Intelligence Community General Counsels 
and Inspectors General, respectively, to report to the lOB on a quarterly basis concerning 
intelligence activities that they have reason to believe may be unlawful or contrary to Executive 
Order or Presidential Directive. The enclosed memorandum covers all reportable activities 
known to the Inspector General and General Counsel. Per PIOB letter of 6 August 1982, 
Agency heads are responsible for reporting separately any additional reportable activities 
known to them, unless the President has specifically instructed that the Board is not to be 
informed. The Director’s signature signifies that no other activities that require repH>rting are 
known to him. 

RECOMMENDATION: (U) Director sign the enclosed memorandum. 


Approved for Release bv NSA on 12-22-2014, FQIA Case # 70809 (LitlQationl 

This document may be declassified 

and marked “UNCLASSIFIED/ /F6f Offldal Una Only" 

upon removal of enclosure!s) 

^ y^{b) {3)-P.L. 86-36 


COORDINATION/APPROVAL 


OFFICE 

NAME ANIMATE 

SECURE ■ 
PHONF 

OFFICE 

NAME AND DATE 

SECURE 

PHONE 

GC 


5548s 

f' . 

1 

1 


AGC(O) 



im 



IG 


3544s 




D/IG 



3544$ 




AIG(IO) 



3544 




rvQir-un 



ORG 

Dll 

PHONE (Secure) 

; 963-2984 ^ 

DATE PREPARED 

30 August 2004 


1 

FORM A6796 FEB 94 DERIVED FRO.M: NS/UCSS. 

NSN; 7S40-FM-001-5465 DATED: 24 February 1998 

DECLASSIFY ON XI 

M 123-2 

SECURITY CLASSIFICATION 

































DOCID: 4165384 


SECRET//COMINT//NOFORN//X1 



NATtONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE, MARYLAND 2075S-6000 


13 September 2004 


MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 

THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (U// ^^UO )- Report to the Intelligence Oversight Board on NSA 
Activities - INFORMATION MEMORANDUM 


(U//POUO)" Except as previously reported to you or the President, or 
otherwise stated in the enclosure, we have no reason to believe that any intelligence 
activities of the National Security Agen^ during the quarter ending 30 June 2004 
were unlawful or contrary to Executive Order or Presidential Directive, and thus 
required to be reported pursuant to Section 1.7.(d) of Executive Order 12333. 


(UZ/FOUQT* The Inspector General and the General Counsel continue to 
exercise oversight of Agency activities by means of inspections, surveys, training, 
review of directives and guidelines, and advice and counsel. These activities and 
other data requested by the Board or members of the staff of the Assistant to the 
Secretary of Defense (Intellige/Je^Oversight) are described in the enclosure. 



JOEL F. BREI 
Inspect 



ITZ 
ounsel 


(U//rOUO) I concur in the report of the Inspector General and the General 
Counsel and hereby make it our combined report. 

MICHAEL V. HAYISeN 
Lieutenant General, USAF 
Director, NSA/Chief, CSS 


End: 

Quarterly Report 

DERIVED FROM: NSA/CSSM 123-2 
Dated: 24 Febniary 1998 
Declassify on: XI 


This Document May Be DeclassiHed and Marked 
•‘UNCLASS1FIED //FOR OFFICIAL U SB ONLY 
upon removal of enclo5ure(s). 
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1. (U) INSPECTOR GENERAL ACTIVITIES 

a.'tC/ZSIJDuring this quarter, the Office of Inspector General (OIG) reviewed 
various intelligence activities of the National Security Agency/Central Security 
Service (NSA/CSS) to determine whether they were conducted in accordance with 
applicable statutes, Executive Orders (E.O.s), Attorney General procedures, and 
DoD and internal directives. With few exceptions, the issues presented were 
routine and indicated that the operating elements understand the restrictions on 
NSA/CSS activities. 


b.-^&ySffThe NSA OIG completed an inquiry (see our report dated 17 March 2004) 

into an instance of SIGINT Coll ection against a U.S. Person a broad without 

Attorney General authorization ! I While conducting our 

inquiry into this mishap, we encountered strong indications of shortcomings in the 

control environment that allowed this incident to occur and go undetected for 

almost six months. Corrective action has been directed and will be monitored 

through completion. <b) (i) 

(b) (3)-P.L. 86-36 


c-' tSA^OI/ZIiF) Two more individuals assigned to the[ 


(see our quarterly reports of 18 September 2003 and 9 June 2004) have admitted 
misusing the U.S. SIGINT system by conducting unauthorized electronic 
surveillance of U.S. and non-U.S. persons abroad. The unauthorized surveillances 
were conducted for no legitimate foreign intelligence purpose. —^ (b) (i) 

(b) (3)-P.L. 86-36 
-(b) [^i-bU'Uyi 3024 


( S // 6 I//NP )- In response to these incid ents the Director NSA and 


them of the consequences of misconduct' 


issued a joint message to tl ^ earning 
uct of that type. A copy of the DIItNSA/ 


Director of [ 


M essage, tog ether with amplifying remarks from the Director and Deputy 


are attached as Enclosure 1. 


(i) 


d. (U/ /POUO) Along with inspectors froinl {bij[3 )-p.L. 86-36 

Ithe NSA OIG completed a joint inspection oil ‘\ 

\ The joint inspection report notes that the site's intelligence 
oversight program is weak in training and documentation procedures. The 
inspection team noted that annual refresher training, which is accomplished by 
online posting of required re ading material, is inco nsistent and lacks 

documentation. A revisit to |_by the Joint Inspectors General 

will be scheduled for next year. 
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2. (U) GENERAL COUNSEL ACTIVITIES 

(C//6I) The NSA Office of General Counsel COGC) reviewed various intelligence 
activities of the NSA/CSS to determine whether they were conducted in accordance 
with applicable statutes, E.O.s, Attorney General procedures, and DoD and internal 
directives. The OGC advised Agency elements on a number of questions, including 
the collection and dissemination of communications of or concerning U.S. persons; 
the reporting of possible violations of federal criminal law contained in SIGINT 
product; the testing of electronic equipment; and the applicability of the Foreign 
Intelligence Surveillance Act (FISA). With few exceptions, the issues presented 
were routine and indicated that the operating elements understand the restrictions 
on NSA/CSS activities. The OGC did not file any rejx)rts with the Intelligence 
Oversight Board during this quarter. 


3. (U) SIGINT ACTIVITIES 
a. (S//6 I ) C ollection Against U.S. Persons 
(1) (U) Intentional 

a. t 9//0I) -During this quarter, the Director of the National Se curi ty Agency 

(DIRNSA) granted approval for consensual colle ction against | [ persons. 
DIRNSA-approved consensual collection against [~~l U-S. persons was 
routinely terminated this quarter. (b) (ij 

(b) (3)-P.L. 86-36 

b. (S//SI) The Atto rney General (AG) granted authority to collect the 
communications of] [U.S. persons during this quarter. 


(2) (U) Unintentional 

i. (0//3I ?( 


inadvertently collected from a|_ 

number was a U.S. number. Once noticed,} 


Icommunica tions were 


jin which the called 
were immediately 


deleted. The system is now undergoing testing to determine the reason for 

- (b-Ml) 

/(b) (3)-P.L. 86-36 
■ (bl use 798 


the collection of] 


NSA integree to 


discovered during 


(bl (3-)-50 use 3024 (i) 


subscriberT 


1was associated with | 

[turned out to be used by| 


Irrov, that a tasked 
— —^ 


[-based 




Xwhich handles 


[revealed he is a U.S. Citizen 


[bus iness. Research int^ 
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sn. the 


Upon discoveringi 
^SA inteeree stoon 


date of this report. 


ib) ( 1 ) 

(b)I3)-P.L. 86-36 
(b) (3)-18 use 798 
(b)(3)-50 use 3024(i) 

~l that 

rking the traffic, 

I As of the 


(bj U) 

(b) (3 )-P,Ij. 86-36 
' f U) ' use TBB 

ihi TTcir 7r)->/i (i) 


tb) (1> 

(b)(3)-P.L. 86-36 


_I_[reports had been issue d 

based on the collection. [ |when| [research revealed tha t l I 

was an employee of the U.S. | [ the 

[ceased collection and processing of communication s between the 

and the U.S. person. 

As the in tercepted communications contained significant foreign intelligence, 
the l R equested, pursuant to section 5.4 of USSID 18, a destruction waiver 
for the communications u sed as a basis for the SIG INT product. The request 
was approved by DIRNSA j The | | has deleted all 

commu nications not relevant to the destruction waiver request and has tak en 
steps to{~ I 


d.tO//OI//?JF> This quarter, unintentional retrievals usin g the 
I raw traffic files 

resulted in ] [ incidents against U.S. persons overseas. All incidents were 
reported to responsible oversight officials and corrective actions were taken. 

All unauthorized traffic collected has been destroyed. 

(b) (3)-P.L. 86-36 

b. (U/ /TOUO) Dissemination of U.S. Identities 


(1)(U)[mentiona[ (bi'sl-p.L. se-se 

(S//6I) In accordance with section 7 of USSID 18, U.S. identities were 
disseminated i ~| times during this quarter. The following table shows the 
justification and the number of instances of dissemination: 

In the “Unmasked by Analyst” column, the U.S. identity was revealed in a 
serialized end product; in the “Unmasked at User Request” column, a U.S. 
identity was released to a user at the user’s request. 
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(b) fl) 

(b)(3)-P. 


(b) (3 
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JUSTIFICATION 

Unmasked by 
Analyst 

Unmasked at 

User Request 

TOTAL 

7.2.C Necessary 

•;b,' (it 

(b) (3)-l 

7.2.C.1 Foreign Official 

7.2.C.3 International Narcotics 

7.2.C.4 Criminal Activity 

7.2.C.7 U.S. Government Official 

TOTAL 


L. 86-36 


86-36 


(2) (U) Unintentional 

■■(b) (3)-P.L. 86- 
(b)(3)-ie use 7 
(b){3)-50 use 3 

a. (TS//St->The| 

jhad 

one incident of unintentional dissemination of a U.S. identity. 1 

Ithej 1 


A subsequent phone call to the same 


Jotticial 


ensured the identity had not been further disseminated and that no action 
would be taken until the information was disseminated through proper 
channels. A limited distribution, special series report used to disseminate 
counterintelligence information was subsequently issued. 

b . ( S // S I) During this quarter, SID canceled i I SIGINT products because they 

contained the identities of U.S. persons, organizations, or entities; those 

products that contained information derived from communications of U.S. 

persons were not reissued. I ^ ^ ^ 

^ (b)(3)-P.L. 86-36 


c.tT O/CT 


released a total of | [ reports containing the identities 
of U.S. Persons or based on th e communi cations of persons later identified as 
U.S. Persons. In all instances,] Ji^ncelled the reports, which were 


either not reissued or were reissued with the proper minimization. 


(3) (U) Raw Traffic Dissemination Outside the SIGINT 
Production Chain 

a.- ffS//O fi -As reported in the first quarter, raw SIGINT data was removed 
from the] Iclassified website, which is available to both 


i-P.L. 86-36 
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those personnel who are part of the SIGINT production chain and those who 
are not. The electronic and hard copy data has be en destroyed. On 15 

January 2004 _Intelligence Oversight 

Officer provided follow-up training to all persons involved in this incident. 


(31-P.L. 86-36 


I [ were given access to SIGINT 

information before their clearances were properly vetted. The pilot program’s 
oversight manager and coordinator were informed of the deficiency and policy 
requirements. A database of clearance status was created to lessen the 
likelihood of future access violations. 


c. (S//SI) As part of various agreements with other government agencies, non- 
SIGINT production elements of the NSA/CSS, or government contractors, 
non-SID personnel are granted access to unevaluated, unminimized SIGINT 
data. Many of these individuals are integrated into SID offices, while others 
provide essential enabling work (such as research) in their own spaces. The 
SID ensures that the personnel are trained by the OGC on NSA’s legal 
restrictions and on proper handling and dissemination of SIGINT data prior 



4. (U) OTHER ACTIVITIES 

(U//FOUO) FISA Incidents 


■(b) (1) 

(b)(3)-P.L. 86-36' 


\ that NSA was not authoriz ed to collect. A | 

{ collection manager found the error_ Ail of the 

files have been purged from NSA systems, and no repo rting was done based on the 
unauthorized collection . As this error occurred becausel 1 failed to follow 

standard procedures to ( was remin ded of the 

importance of following standard operatin g procedures that ensure that 

bersonnel will continue to perform periodic 
spot checks of forwarded data to guard against a repeat incident. , 

(b) (3)-P.L. 86-36 
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b. (T0//0I//lJFjt 

(b) (1) 
OGA 
(b) (3) 

(b) (7) (E 



(T£i//OI//NP)f 1 




(U) Assistance to Law Enforcement 


tS//SI) During this quarter, the SID responded to requests for technical assistance 
from law enforcement, including requests fromi 


(b) (1) I 


86-36 


included 


J Assistance 


(U) Working Aids 


(U//POUO) The SID maintains "U.S. Identities in SIGINT" and a matrix of blanket 
reporting waivers on its web page for use by all NSA/CSS analysts. The E.O., 
NSA/CSS Policy 1-23, DoD Regulation 5240.1-R, and USSID 18 are also available 
on-line. Several offices in SID maintain files to be used to prevent targeting of U.S. 
persons. 


(U) Intelligence Oversight Training 


(U //FOUO) During this quarter an intelligence oversight specialist from the SID 
Office of Oversight and Compliance provided on-site training to military, civilian, 
and contractor personnel assigned to| ~1 (3)-p.l. 86-36 
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1 The NSA/CSS Office of General Counsel provided additional 
training to the | /ia video-teleconferencing. The training included Intelligence 
Oversight, E.0.1233 3, USSID 9 and USSID 18, POD Regulation 5240.1-R, 
NSA/CSS Policy 1-23J | 


(b)(3)-P.L. 86-36 
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CiV-NSA) D11 


Fror-r^' 
Sent : 
To: 

Subj 


]@nsa 


Tues day. August 24,2004 3:26 PM 
I ^ nsa 
(U) PLEASE READ 


ClaS sification:" 


rnrNDFORNTTXT 



(b) (3)-P.L. 


86-36 


%/ fTvI: Class. Guide 356-01 
0^^ED;3 July2001 
0ECCLON:X1 


_ please read the no te I rec eived from Lt. Gen. Hayden an' 
^Qj-ning and then read] [and my comments below it. 


this 


Forwarded 



on 08/24/2004 12:59 PM 


■•Hayden. Michael V. (MIL-USAF) D" <mvhayde@nsa> on 08/24/2004 08:33:47 AM 
Please respond to mvhayde@nsa 


|~ ["Black. William B (CIV-NSA) D" <w bblack@nsa>. 

Subject: (U) CA sends for DIR: Message from DIRNSA and | | to | | re Mi 

suse of SIGINT systems 

Classification: 3CCRCT//CO^tINT//^^O^ORN//?Cl 


The enclo sed message was coordinated with T I togoout jointly from . CBmsi-p.l. 86-36 

I and Gen Hayden. It is my understanding that you will disseminate 
lehalf. Please let me know if you have any questions. Thanks! 

I- 1 

Civilian Assistant to the Director 
963-3111 

> (G//0I//I'ir) In less than one year, three[ 

1 


(b) (1) 

(b) (3)-P.L. 86-36 
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> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 

> 


employees have admitted misusing the United States SIGINT System to 
conduct unauthorized electronic surveillances of both U.S. and non-U.S. 
persons abroad. These unauthorized surveillances were conducted for no 
legitimate foreign intelligence purpose. We are required to report these 
incidents to the Department of Justice for possible prosecution. Please 
inform your employees in the strongest terms that we will not tolerate 
misconduct of thi s kind , which may be punishable by recall from assignment 
and removal from i 1 by separation from employment, and in the case of a 
criminal conviction, by fine and/or imprisonment. 


DRV FM: NSA/CSS Manual 123-2 
Dated: 24 Feb 98 
DECLON:Xl 


Classification . SECRET//CQMP ' lT//l » ?OrORN//Xl 


Three of our colleagues have violated the trust we have placed in them. The 
use of our collection systems or any other government equipment for personal 
purposes is unacceptable under any circumstances. Although not referred to in 
this e-mail, failure to report foreign national contacts, failure to provide 
accurate financial accounting, failure to file accurate Time & Attendance 
reports, failure to pay Government credi t card balances in a timely manner, etc. 
remain troubling issues among the l I workforce and are also subject to severe 
penalties. In order to successfully execute our mission, all of you are given 
great latitude to meet your responsibilities. With this responsibility comes 
the accountability to remain within the rules, regulations and laws that apply. 
Failure to do so is a serious matter that will result in dire consequences as 
noted in the above e-mail. It is our responsibility to fully understand the 
rules, regulations and laws under which we operate. Our failure to understand 
these are not an acceptable defense. Know the rules - follow the rules. If you 
don t know or are unsure - ask. If you are considering violating the rules - 
dont. If you have violated the rules - tell us now. 


,•••■ (b) (3)-P.L. 86-36 
(b) (1) 


Unfortunately, these three individuals’ actions coupled with other recent 
lapses of good judgement by a f ew of our | [ colleagues has resulted in 

increased scrutiny of all of us in | | This increased scrutiny will continue 

until such time as we demonstrate, over a long period of time, that we are all 
fully responsible intelligence community em ployees w ho know and follow the rules 

while executing good judgment in all we do. | | sent two e-mails some time <b) (3 )-p.l. 86-36 

ago stating that we have come too far to risk losing it due to our poor 

decisions while executing our mission. Likewise, 1 have spoken to a number of 

you here at Headquarters or in the field on my TDYs about t he same th ing. It 

remains true today and this e-mail from Lt. Gen. Hayden and l d ocument a 

sad chapter in our proud history. In spite of this, we are still the premiere 

intelligence collection and reporting organization in the Intelligence 

Community. Everyday we make significant and timely contributions to the needs 
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of our country under often very. licuit conditions. Everyday we make 
thousands of successful decisions that effect the security and safety of our 
country. Everyday the vast majority of us in i ti emonstrate integrity in our 
actions and are conscientious in doing our job within the parameters set for us. 
Everyday you make me proud to be a member of this organization and be given the 
opportunity to lead you. We cannot and should not tolerate illegal or 
inappropriate actions in our workforce - it detracts from all the good that we 
do and taints us by association. I ask for your increased attention to the 
rules, regulations and laws that we must follow. It is important for each of us 
to always conduct ourselves in a manner that is a model for others and beyond 
reproach. 

If you have questions or comments, please contaetT lor me. 


(b) (1) 

(b) (3)-P.L. 86-36 


(b) (3)-P.L. 86-36 
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